CISSE Advanced Level
Information Systems Security cheat sheet
Every chapter's key points, formulas and definitions on one page, for the last week before the exam. Each heading links to the chapter that explains it.
Overview of information systems security
- Security practice is organised around the CIA triad, confidentiality, integrity and availability, with authenticity and non-repudiation extending it.
- Name the objective a scenario breaches from what happened to the information: read without authority is confidentiality, altered without authority is integrity, made inaccessible is availability.
- Information assets are identified and classified, typically as public, internal, confidential or restricted, before they are protected, so controls match what each asset is worth.
- Risk arises only where a threat meets a vulnerability, and its size depends on likelihood and impact together.
- IS security has technical, physical, human, third-party and legal scope, and is managed with metrics such as mean time to detect, mean time to respond and patch compliance.
Key terms
- Confidentiality
- Information is disclosed only to those authorised to see it. Breached by an unauthorised read, a leaked customer database, a screen left visible to a passer-by.
- Integrity
- Information is accurate and has not been altered without authorisation. Breached by an unauthorised write, a tampered exam script, a manipulated bank balance.
- Availability
- Information and systems are accessible to authorised users when needed. Breached by a denial-of-service attack, a ransomware lockout, a failed server with no backup.
- Threat
- A potential cause of an unwanted incident, a malicious actor, a natural disaster, a hardware failure. A threat exists independently of any particular organisation.
- Vulnerability
- A weakness that a threat can exploit, an unpatched system, a weak password policy, a building with no fire suppression. Vulnerabilities are specific to the organisation's own environment.
- Risk
- The likelihood of a threat exploiting a vulnerability, combined with the impact if it does. Risk is what is actually managed; a threat with no exploitable vulnerability, or a vulnerability no threat can reach, carries no real risk.
The rest of the sheet covers
- Security standards and frameworks
- Network and computer security
- Data protection
- Security controls
- Security policies
- Penetration testing
- Designing and building secure systems
- Business continuity and disaster recovery
- Security audit
- Exam technique and revision
- Glossary